secret_matcher

Module: secret_matcher

Contents

Structs

• SecretJsonSelector - A JSONPath selector whose evaluation root is explicit.

Enums

• SecretJsonSelectorScope - Evaluation root for a [SecretJsonSelector].
• SecretMatcher - How to extract (name, value) pairs from a vault CLI’s stdout or an
• SecretNameSource - How a JSON record’s secret name is determined.

---

firma_config_schema::secret_matcher::SecretJsonSelector

Struct

A JSONPath selector whose evaluation root is explicit.

The scope is part of the serialized shape, for example {"path":"$.title","scope":"document"}; scope is never inferred from JSONPath syntax. Cardinality depends on both the selector’s role and its scope: record-scoped item selectors require one match per record, while a document-scoped item selector accepts zero or one match. Domain selectors require one or more valid string matches at every applicable root. See the field docs on [SecretMatcher::Json] for failure behavior.

Fields:

• path: String - JSONPath evaluated at the root selected by [Self::scope].
• scope: SecretJsonSelectorScope - Whether the path is relative to each record or to the whole document.

Traits: Eq

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Clone
  • fn clone(self: &Self) -> SecretJsonSelector
• PartialEq
  • fn eq(self: &Self, other: &SecretJsonSelector) -> bool
• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>

firma_config_schema::secret_matcher::SecretJsonSelectorScope

Enum

Evaluation root for a [SecretJsonSelector].

Variants:

• Record - Evaluate independently against every node selected by record_path.
• Document - Evaluate once against the document root and broadcast the selector results.

Traits: Eq, Copy

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> SecretJsonSelectorScope
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• PartialEq
  • fn eq(self: &Self, other: &SecretJsonSelectorScope) -> bool
• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>

firma_config_schema::secret_matcher::SecretMatcher

Enum

How to extract (name, value) pairs from a vault CLI’s stdout or an HTTP vault’s response body.

Internally tagged ({"type": "json", ...} rather than the default {"Json": {...}}) so it nests as a flat table when embedded in TOML (e.g. the Sidecar’s http_secret_providers config) as well as JSON.

Variants:

• Json{ record_path: String, value_path: String, name: SecretNameSource, item_selector: Option<SecretJsonSelector>, domain_selector: Option<SecretJsonSelector> } - JSONPath extraction over structured output.
• Regex{ pattern: String } - Regex extraction over text output. The pattern carries a required

Traits: Eq

Trait Implementations:

• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Clone
  • fn clone(self: &Self) -> SecretMatcher
• PartialEq
  • fn eq(self: &Self, other: &SecretMatcher) -> bool
• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result

firma_config_schema::secret_matcher::SecretNameSource

Enum

How a JSON record’s secret name is determined.

Most providers store the secret’s name as an explicit string value (e.g. a label or key field) selected by Path. Some providers — e.g. HashiCorp Vault’s kv get -format=json, which returns a flat {name: value, ...} secret map with no separate name field — instead encode the name as the record’s own key in its parent JSON object; use RecordKey when record_path selects records that way.

Variants:

• Path{ path: String } - Record-relative JSONPath selecting the name string, aligned by
• RecordKey - The record’s own key in its parent JSON object — the final segment of

Traits: Eq

Trait Implementations:

• PartialEq
  • fn eq(self: &Self, other: &SecretNameSource) -> bool
• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Clone
  • fn clone(self: &Self) -> SecretNameSource